topic Re: Heavy forwarder with 2nics not communicating on 8089 in Getting Data In

Heavy forwarder with 2nics not communicating on 8089

nickstone — Wed, 10 Aug 2016 21:54:02 GMT

I have a heavy forwarder running 6.4.1 on CentOS 7 with 2 nics on seperate subnets (data and mgt) that won't communicate on port 8089.

In a netstat I can see that 8089 is listening but no comms.

When I disable one of the interface, everything works fine.

Any ideas?

Re: Heavy forwarder with 2nics not communicating on 8089

mtranchita — Tue, 29 Sep 2020 10:35:06 GMT

Guessing that splunk is confused about what IP it should be using. I would try setting the IP for interface that you want use by setting SPLUNK_BINDIP= in the splunk-launch.conf.
Note that this conf file is not in apps but rather $SPLUNK_HOME/etc/splunk-launch.conf.
Double check the spec, http://docs.splunk.com/Documentation/Splunk/latest/Admin/Splunk-launchconf, for syntax.
Hope this helps!

Re: Heavy forwarder with 2nics not communicating on 8089

nickstone — Thu, 11 Aug 2016 00:01:11 GMT

this will bind both 8089, 9997 AND web to that interface right? Web needs to be separated to mgt and not on data otherwise it defeats the purpose of segmentaton

Re: Heavy forwarder with 2nics not communicating on 8089

mtranchita — Thu, 11 Aug 2016 00:05:12 GMT

right, sorry.
Have you tried setting mgmtHostPort in web.conf?

Re: Heavy forwarder with 2nics not communicating on 8089

nickstone — Thu, 11 Aug 2016 01:22:00 GMT

mgmtHostPort is set to localhost on port 8089

Re: Heavy forwarder with 2nics not communicating on 8089

nickstone — Thu, 11 Aug 2016 01:57:29 GMT

never mind SElinux,....

Re: Heavy forwarder with 2nics not communicating on 8089

ephemeric — Mon, 23 Aug 2021 15:32:28 GMT

LOL! SELinux again.

grep "denied" /var/log/audit/audit.log